# HG changeset patch # User DJ Mountney <dj@gitlab.com> # Date 1613079034 28800 # Thu Feb 11 13:30:34 2021 -0800 # Node ID 639f301c10a4d4f8422f99ac682418488e021200 # Parent 6c81e7db5755c48beb007bf9015c25f06f7f6e5f Merged branch "hufa/omnibus-gitlab-master" into "master" MR: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/4953 diff --git a/changelogs/unreleased/hufa-fix-docker-pam.yml b/changelogs/unreleased/hufa-fix-docker-pam.yml new file mode 100644 --- /dev/null +++ b/changelogs/unreleased/hufa-fix-docker-pam.yml @@ -0,0 +1,5 @@ +--- +title: configure sshd and git account so that pam is not used any longer in docker +merge_request: 4953 +author: Fnordpol +type: fixed diff --git a/docker/Dockerfile b/docker/Dockerfile --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -17,8 +17,7 @@ tzdata \ nano \ less \ - && rm -rf /var/lib/apt/lists/* \ - && sed 's/session\s*required\s*pam_loginuid.so/session optional pam_loginuid.so/g' -i /etc/pam.d/sshd + && rm -rf /var/lib/apt/lists/* # Remove MOTD RUN rm -rf /etc/update-motd.d /etc/motd /etc/motd.dynamic diff --git a/docker/assets/setup b/docker/assets/setup --- a/docker/assets/setup +++ b/docker/assets/setup @@ -46,7 +46,9 @@ groupadd -g 991 gitlab-consul # Create accounts -useradd -m -u 998 -g git -m -s /bin/sh -d /var/opt/gitlab git +## The git account is created with * as crypted password as ssh treats the account as locked if it has a ! +## Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab +useradd -m -u 998 -g git -p '*' -m -s /bin/sh -d /var/opt/gitlab git useradd -m -u 999 -g gitlab-www -m -s /bin/false -d /var/opt/gitlab/nginx gitlab-www useradd -m -u 997 -g gitlab-redis -m -s /bin/false -d /var/opt/gitlab/redis gitlab-redis useradd -m -u 996 -g gitlab-psql -m -s /bin/sh -d /var/opt/gitlab/postgresql gitlab-psql diff --git a/docker/assets/sshd_config b/docker/assets/sshd_config --- a/docker/assets/sshd_config +++ b/docker/assets/sshd_config @@ -15,9 +15,10 @@ AuthorizedKeysCommand /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check git %u %k AuthorizedKeysCommandUser git -# Fix: User username not allowed because account is locked # With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works -UsePAM yes +# Please make sure that the account is created without passwordlogin ("*" in /etc/shadow) or configure pam. +# Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab +UsePAM no # Disabling use DNS in ssh since it tends to slow connecting UseDNS no